Auditor
Keeps the append-only record of what runs, spends, grants and refuses. Each row is chained to the one before it and redacted of secrets and prompts, so a changed or removed row is detectable. Checkpoints are sealed to storage that refuses overwrites.
- Design rules
- LG1, LG2
- Contracts offered
- 1
- Key flows
- 4
On the job
- Appends rows to a hash chain with secrets and prompts redacted
- Verifies the chain on request
- Seals checkpoints to write-once storage
- Allows one writer at a time through a lease
Not my job
- Judge what the rows mean. That is the Inspector and the people who read them.
- Delete or edit a row. Nothing can.
What Auditor does, step by step
Record an event
Every member writes through the same door.
A member sends an event: who acted, what happened, which agent, which run.
Works with Gatekeeper· contractLedgerStore / verifyChain →Gatekeeper, Landlord, Treasurer, Bouncer, Keymaster and Registrar all append.Secrets and prompts are redacted before anything is stored.
The row gets the next sequence number and a hash of its content plus the previous hash.
The row is tapped to the event hub, so live views and the bus see it.
Verify the chain
Anyone with read access can check the book.
verifyChain recomputes each hash from the genesis value forward.
It returns ok, or the first sequence number where the chain breaks and why.
Seal a checkpoint
Where the checkpoint goes depends on the landing zone.
The Checkpointer writes the latest sequence number and hash to a checkpoint sink.
The sink is write-once storage that refuses overwrites, provided by the landing zone.
Starting a new segment archives the old one and carries its last hash forward as the new genesis.
Keep one writer
Two writers would fork the chain.
A LedgerLease is taken before the first append.
A second holder gets LeaseHeldError and stays read-only.
Contracts Auditor keeps 1 offered
- LedgerStore / verifyChainused by Gatekeeper, Landlord, Treasurer, Bouncer, Keymaster, Registrar, Timekeeper